ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.9 - Unauthenticated Missing Authorization to Mailchimp List Subscription Manipulation via 'listed' and 'double_opt_in' Parameters
- ID
- WPSEC-2026-2289
- Plugin
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite)
- Affected
- all versions before 4.1.0
- Remediation
- Update to 4.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the Mailchimp widget subscribe REST endpoint in all versions up to, and including, 4.0.9 due to the endpoint trusting the Mailchimp list ID, the double opt-in flag and arbitrary merge field names supplied in the request instead of the widget's configured settings. This makes it possible for unauthenticated attackers to use the site's stored Mailchimp API key to add arbitrary email addresses to any audience on the connected Mailchimp account, bypass double opt-in so contacts are marked as subscribed, and set arbitrary merge field values.
References
- https://wpsec.com/vuln/WPSEC-2026-2289/
- https://plugins.svn.wordpress.org/elementskit-lite/tags/4.1.0/
- https://wordpress.org/plugins/elementskit-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS